What Is Claimed Is: 



1 LA method for establishing a list of security scanner attributes for a 

2 computing node within a hierarchy of computing nodes, the list of security 

3 scanner attributes being associated with a security scanner action to be performed 

4 by a security scanner program, the method comprising: 

5 establishing a hierarchy of lists of attributes, an attribute being comprised 

6 of an attribute identifier and an attribute value, the attribute value being comprised 

7 of either a list of attributes or a controlling value used by the security scanner 

8 program to control an operation of the security scanner program, the list of 

9 attributes being comprised of a grouping attribute and a series of one or more 
% 10 attributes; 

' H i 1 1 examining the grouping attribute associated with the list of attributes; 

jj 12 updating an element of the list of attributes if the grouping attribute 

% 1 3 indicates that the element may be updated without also updating other elements in 

14 the list of attributes; 

1 5 updating the element and all other elements of the list of attributes if the 

16 grouping attribute indicates that updating the element requires all other elements 

17 to be updated; and 

1 8 updating the element, all other elements, and all subordinate elements of 

19 the list of attributes if the grouping attribute indicates that updating the element 

20 requires all subordinate elements of the list of attributes to be updated. 

1 2. The method of claim 1 , wherein the element of the list of attributes 

2 contains an identifier that uniquely identifies the element and a value, wherein the 

3 value may itself be a list of elements. 
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1 3. The method of claim 1 , wherein the grouping attribute indicates 

2 one of: 

3 the element may be updated without also updating other elements in the 

4 list of attributes; 

5 updating the element requires all other elements in the list of attributes to 

6 be updated; and 

7 updating the element requires all other elements in the list of attributes and 

8 all subordinate elements in the list of attributes to be updated. 

1 4. The method of claim 2, wherein updating the element involves 

2 overwriting the value with another value that may be identical to an original 

3 value. 

1 5. The method of claim 2, wherein updating the element and all other 

2 elements of the list of attributes involves overwriting each value with another 

3 value that may be identical to an original value. 

1 6. The method of claim 2, wherein updating the element, all other 

2 elements in the list of attributes, and all subordinate elements of the list of 

3 attributes involves overwriting each value with another value that may be identical 

4 to an original value for each element and each subordinate element of the list of 

5 attributes. 

1 7. The method of claim 2, wherein if the attribute being updated is 

2 itself another list of attributes, the grouping attribute can indicate one of: 

3 the attribute can be updated; 

4 a content of the list of attributes can be replaced; and 
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the other list of attributes can be merged with the list of attributes. 



8. 



The method of claim 1 5 wherein the security scanner program 



2 performs a scanning process on files associated with the computing node for 

3 malicious computer instructions, wherein details of the scanning process are 

4 specified by the list of security scanner attributes. 



2 when executed by a computer causes the computer to perform a method for 

3 establishing a list of security scanner attributes for a computing node within a 

4 hierarchy of computing nodes, the list of security scanner attributes being 

5 associated with a security scanner action to be performed by a security scanner 

6 program, the method comprising: 

7 establishing a hierarchy of lists of attributes, an attribute being comprised 

8 of an attribute identifier and an attribute value, the attribute value being comprised 

9 of either a list of attributes or a controlling value used by the security scanner 

1 0 program to control an operation of the security scanner program, the list of 

1 1 attributes being comprised of a grouping attribute and a series of one or more 

12 attributes; 

13 examining the grouping attribute associated with the list of attributes; 

14 updating an element of the list of attributes if the grouping attribute 

1 5 indicates that the element may be updated without also updating other elements in 

1 6 the list of attributes; 

1 7 updating the element and all other elements of the list of attributes if the 

1 8 grouping attribute indicates that updating the element requires all other elements 

19 to be updated; and 

20 updating the element, all other elements, and all subordinate elements of 



9. 



A computer-readable storage medium storing instructions that 
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21 the list of attributes if the grouping attribute indicates that updating the element 

22 requires all subordinate elements of the list of attributes to be updated. 

1 10. The computer-readable storage medium of claim 9, wherein the 

2 element of the list of attributes contains an identifier that uniquely identifies the 

3 element and a value, wherein the value may itself be a list of elements. 

1 11. The computer-readable storage medium of claim 9, wherein the 

2 grouping attribute indicates one of: 

3 the element may be updated without also updating other elements in the 

4 list of attributes; 

5 updating the element requires all other elements in the list of attributes to 

6 be updated; and 

7 updating the element requires all other elements in the list of attributes and 

8 all subordinate elements in the list of attributes to be updated. 

1 12. The computer-readable storage medium of claim 10, wherein 

2 updating the element involves overwriting the value with another value that may 

3 be identical to an original value. 

1 13. The computer-readable storage medium of claim 1 0, wherein 

2 updating the element and all other elements of the list of attributes involves 

3 overwriting each value with another value that may be identical to an original 

4 value. 

1 14. The computer-readable storage medium of claim 10, wherein 

2 updating the element, all other elements in the list of attributes, and all 
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3 subordinate elements of the list of attributes involves overwriting each value with 

4 another value that may be identical to an original value for each element and each 

5 subordinate element of the list of attributes. 

1 15. The computer-readable storage medium of claim 10, wherein if the 

2 attribute being updated is itself another list of attributes, the grouping attribute can 

3 indicate one of: 

4 the attribute can be updated; 

5 a content of the list of attributes can be replaced; and 

6 the other list of attributes can be merged with the list of attributes. 

1 1 6. The computer-readable storage medium of claim 9, wherein the 

2 security scanner program performs a scanning process on files associated with the 

3 computing node for malicious computer instructions, wherein details of the 

4 scanning process are specified by the list of security scanner attributes. 

1 1 7. An apparatus that facilitates establishing a list of security scanner 

2 attributes for a computing node within a hierarchy of computing nodes, the list of 

3 security scanner attributes being associated with a security scanner action to be 

4 performed by a security scanner program, comprising: 

5 an establishing mechanism that is configured to establish a hierarchy of 

6 lists of attributes, an attribute being comprised of an attribute identifier and an 

7 attribute value, the attribute value being comprised of either a list of attributes or a 

8 controlling value used by the security scanner program to control an operation of 

9 the security scanner program, the list of attributes being comprised of a grouping 

1 0 attribute and a series of one or more attributes; 

1 1 an examining mechanism that is configured to examine the grouping 
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12 attribute associated with the list of attributes; 

13 an updating mechanism that is configured to update an element of the list 

14 of attributes if the grouping attribute indicates that the element may be updated 

1 5 without also updating other elements in the list of attributes; 

16 wherein the updating mechanism is further configured to update the 

1 7 element and all other elements of the list of attributes if the grouping attribute 

1 8 indicates that updating the element requires all other elements to be updated; and 

19 wherein the updating mechanism is further configured to update the 

20 element, all other elements, and all subordinate elements of the list of attributes if 

21 the grouping attribute indicates that updating the element requires all subordinate 

22 elements of the list of attributes to be updated. 

1 18. The apparatus of claim 1 7, wherein the element of the list of 

2 attributes contains an identifier that uniquely identifies the element and a value, 

3 wherein the value may itself be a list of elements. 

1 19. The apparatus of claim 17, wherein the grouping attribute indicates 

2 one of: 

3 the element may be updated without also updating other elements in the 

4 list of attributes; 

5 updating the element requires all other elements in the list of attributes to 

6 be updated; and 

7 updating the element requires all other elements in the list of attributes and 

8 all subordinate elements in the list of attributes to be updated. 

1 20. The apparatus of claim 18, wherein the updating mechanism is 

2 configured to overwrite the value with another value that may be identical to an 
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1 original value. 

1 21. The apparatus of claim 1 8, wherein the updating mechanism is 

2 configured to update the element and all other elements of the list of attributes by 

3 overwriting each value with another value that may be identical to an original 

4 value. 

1 22. The apparatus of claim 1 8, wherein the updating mechanism is 



2 configured to update the element, all other elements in the list of attributes, and all 

3 subordinate elements of the list of attributes by overwriting each value with 

4 another value that may be identical to an original value for each element and each 

5 subordinate element of the list of attributes. 

1 23 . The apparatus of claim 1 8, wherein if the attribute being updated is 

2 itself another list of attributes, the grouping attribute can indicate one of: 

3 the attribute can be updated; 

4 a content of the list of attributes can be replaced; and 

5 the other list of attributes can be merged with the list of attributes. 

1 24. The apparatus of claim 1 7, wherein the security scanner program is 

2 configured to perform a scanning process on files associated with the computing 

3 node for malicious computer instructions, wherein details of the scanning process 

4 are specified by the list of security scanner attributes. 
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